[snchimata]

Summary

• Add a manual-only bootstrap workflow that stages the five new native npm packages without weakening two-factor authentication.
• Reuse the exact already-tested addon binaries from publication run 42955400102/artifact 13827437119. Check all original SHA-256 hashes before processing.
• Correct the missing repository metadata required for provenance. Repack only package.json; verify unchanged addon/license bytes, record original/new hashes and upload the corrected artifacts before staging.
• Keep provenance enabled, ignore package scripts, require maintainer 2FA approval, and document per-package trusted publisher setup.
• Preserve all SDK code, versions, original GitHub release assets and immutable v0.6.0 tag.

Root causes

• The local publishing token authenticates but has bypass_2fa=false; unattended direct creation of the new native packages fails EOTP. The root tokenfold trusted publisher does not authorize other package names.
• All five native manifests omitted repository metadata. Granting token permissions alone would not fix the documented provenance prerequisite.

Validation

• Actionlint, active-version consistency and diff checks pass.
• Node 24 full suite: 48 passed, zero skips. Focused regression checks include real Bash with fake npm: original or corrected checksum corruption blocks every upload.
• Python archive tests cover metadata-only deterministic repack, unexpected/missing entries, manifest drift and refusal to overwrite the source.
• Corrected Windows packed native addon installed offline with the original tested root/CLI tarballs; Core example passed on Node 22/24 and installed compiled bytes equal the original addon.
• Independent review verified all five metadata-only conversions and byte/hash receipts. Hosted installed-artifact CI must pass before merge.

Operator boundary

Staging creates public package placeholders, but not public 0.6.0 native contents. A real maintainer must approve the five stages with 2FA. Only then resume the original failed npm job and verify public versions/digests/fresh install. No credentials, generated tarballs or caches are committed.